Ethical Hacking Overview

20. Analyzing Findings

Now, when you go through and you actually stumble across some particular finding, you need to analyse that finding. It's really interesting because this is kind of a tongue twister. It can really kind of get you turned around backwards if you're not really careful. So I'm going to give you some examples of this in the questions that you're going to use. But the thing that you need to understand is that a false positive is something that's incorrectly identified. A false negative is something that's incorrectly rejected. A true negative is something that is correctly and correctly rejected. And a true positive is something that is correctly identified.

21. Calculating SLE, ARO, ALE

Okay, guys, just one last calculation, and we're going to end up wrapping this thing up. This is going to give us the capability with some of these formulas to calculate the single loss expectancy, an annualised rate of occurrence, and an annual loss expectancy, right? So let's give us an example of this. The single loss expectancy is, for example, $50,000 per event. Maybe something happens where a server is taken out and it's going to cost us $50,000 to fix it. With an annualised rate of occurrence of about 50%, the risk is expected to occur once every other year on average. So the annualized loss expectancy is equal to $50,000 times the aro, which is the annualised rate of occurrence or $25,000.

22. Other Penetration Testing Methodologies

Okay, guys, we're just about ready to wrap this particular section up. And one of the last things we're going to talk about is the penetration testing methodologies. And you probably thought, well, wait a minute, Tim. We've already talked about that. That was the one you said was the most popular, the O S St. model. And you're absolutely right. We did. We talked about this because it is indeed the most popular. It was written by a gentleman by the name of Peter Herzog. It's not necessarily the only methodology. There are other ones that can be used in a penetration test as well. There's one. For example, the NIST methodology for the National Institute of Standards and Technology They provide guidelines on network security testing.

Financial institutions tend to have their own. So this one happens to be for the Federal Financial Institution Examination Office, or FFIEC. And then lastly, we have this Information System Security Assessment Framework, all right? And you'll typically see it written as Oissg. You may also see it as an open system or Oissg. Now, you may be asking yourself, do I need to use all of these? And the answer is, no, you don't. You are typically told which methodology you should be using in the particular environment that you're bidding on. So if it's a bank or financial institution, it’s very likely you're going to be using the oFFIEC if it's pretty much anything else. In my experience, it's always been the OSS TMM, but that doesn't mean you couldn't create your own methodology.

Now remember, a methodology is nothing more than a set of steps to get to or achieve some goal. And so if everyone is doing the same steps and we're in sync, that means we both should arrive at the same determination. So there are companies that may take some ideas from the Ossmm and possibly some from this. You can move things around if you would like to, unless there is some reason in your organization they want to have it done in a particular way. But the biggest thing is that you've got to be consistent. You've got to do it this way every time, because you're going to be using these penetration tests, the ones from last year, the ones from six months ago, and so on, to compare to the results you have today. And it's interesting because some people look at things that need to be fixed right away, and others tend to shrug some of this off. And we'll talk about that more in the next particular section.

FootPrinting - Reconnaissance and Information Gathering

1. Introduction to Footprinting

In this section, we'll talk about the information that is gathered by the hacker. We'll discuss methods of obtaining information: physical access, social engineering access, digital access, passive versus active reconnaissance foot printing, and we'll discuss tools like Reconciliation and G foot printing tools like Multiage, the most powerful hacking tool on the internet today, and foot printing tools like in his Lookup traceroute and the Edge database. We'll discuss Google and its query operators, the Internet Arcade, the Way back Machine, domain name registration, who is the operator, as well as demonstrations on various topics.

2. What Information is Gathered by the Hacker

In this particular lecture, we're going to take a look at what information is gathered by the hacker. The idea behind footprinting a network is to get an idea of how much of the layout and specifications we have without altering the target. Like a bank robber in a heist film, you would look to obtain blueprints of the network and company, including what type of alarm system they have, those kinds of things. Think of Ocean's Eleven or one of those types of films where they plan this out meticulously. They know exactly how much time it takes to get from point A to point B. That's the whole idea behind Footprinting in our Footprinting that we're going to do ourselves. This is going to include things like what servers are running, what versions of software that they're running, how the internal network is actually configured, and what formats they use for internal usernames and email addresses.

Once this blueprint is complete, you'll be in a much better position to see what methods, routes, and exploits your attack will actually take. The first thing the hacker is going to want to know is who owns this system. Is it going to be someone who would perhaps chase after them if they attempt to break in? Let's take an example of Kindergare daycare and then compare that with Bankofamerica.com. If we broke into Kindergare daycare, it's very unlikely that someone is going to be chasing after us, trying to figure out what we're doing. But boy, Bank of America, that would be the place where somebody would be doing that. They're going to be interested in who owns these systems. They're going to be interested in what kind of systems are being used. If we just simply go out to Monster.com or Dice.com, if they're advertising somebody, we need somebody to get off of. We need someone to help us move our system from this version of Active Directory to this version of Active Directory. They're actually telling you what kind of systems they actually have. How many offices do we have? The more offices that we have, the more our IT infrastructure support is spread out.

When I worked at the mortgage company in Dallas, we had 987 branches around the US. We had our main sport in Dallas. So, if I were to attack one of those mortgage branches, I'd attack one of them and then ride back in on that connection to the Dallas office. What sort of connectivity do we have between the sites? Are we connected via leased lines, tone lines, or fractional T1 lines? In other words, connections that you would get from the phone company? Or are we leveraging things over the Internet, perhaps things over the Internet where we're encrypting the connection between them? What type of telephone PABX systems are being used? Now I'm going to take a different approach on this next slide, and I'm going to get into that one. "Central or decentralised It supports Centralized Its support may be easier or more difficult to deceive, but you must know where your support is located and what servers and services are accessible via the internet. I want to do this really quick example and explain to you when we were talking about the telephone and PABX system. This is something called walking the.ORG chart.

When I say I'm walking the org chart, I'm talking about the organisational chart of the company. Let's say, for example, we call in at two in the morning and we call into the help desk where Bill is the person we're trying to target. He answers the phone. This is Bill's Cheers at extension 44 21. I'm sorry, I'm not available right now. If you need meeting assistance, you can call my boss, John Sears, at extension 40 412. Then we hang up the phone and call John Sears. John Sears answers the phone. Hello, this is John Sears at extension 441 two I'm not available right now. If you need immediate assistance, you can call my boss, Greg Simmons, at extension 44 32.

We have all of the information to pull off what we're trying to do. We call Bill back and explain everything. Bill, this is Greg Simmons. Do you know who I am? Yes, Mr. Simmons. Of course I do. Unfortunately, we have a problem with your boss, John Sears. Can I definitely depend on you to keep this conversation between just us? Oh, yes, of course I can do that. I need you to reset John's password and please do not give him another one until I say so. Can you do that for me? Yes, of course I could do that. Now we've just laid the fact where Bill is going to expect to get ahead if he keeps his and moves ahead of John. Now, this is not going to work if Bill and John are good friends, but you know, any time you're trying to do foot printing, any time you're trying to do reconnaissance, you have to take a few chances. And so this is what's referred to as "walking the.ORG chart."

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap Certified Ethical Hacker v10 Exam certification video training course that goes in line with the corresponding ECCouncil 312-50v10 exam dumps, study guide, and practice test questions & answers.